Splunk Search

Query help lookup

surekhasplunk
Communicator

Hi,

I am using below query to get a match by SUBNET from B.csv and get the IP filed.
And show all fields from A.csv with the matching SUBNET from b.csv and get the IP field.

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET |lookup B.csv SUBNET output IP

But now i am facing issue where all the IPs are not show in my result. Only 100 records are coming whereas there are more than that.

Why i am getting only 100 results and is there any other way to show.

Tags (2)
0 Karma

manjunathmeti
Champion

You are using OUTPUT clause which makes the output lookup fields overwrite existing fields in the events. You can use below query to preserve IP field:

| inputlookup A.csv |bla blal | where arp_usage_percentage>60 | rename subnet_global as SUBNET | lookup B.csv SUBNET OUTPUT IP AS MATCHED_IP
0 Karma

surekhasplunk
Communicator

Hi @manjunathmeti ,

Thanks for the reply but looks its the same even if i use IP as MATCHED_IP
Note: there is no IP field in A.csv file. So overwriting cant be the issue from my point of view.
there is something which just limits and so we are getting only 100 IPs for each of the SUBNET

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...